Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat, etc.).

Is there any way to send payment card data securely through some sort of online service?

Business Case:

  • Client is calling Company Office “A” and requesting a booking.
  • Company Office A has no credit card data on file in the GDS profile nor in the company system.
  • Client is providing the credit card information by phone.
  • As Company Office “B” has to process the booking, Company Office “B” must be provided with the CC Data.
  • Company office “B” is using a different GDS and a PNR cannot be transferred.

As far as I know, we are not allowed to send credit card data via email especially since internal email is not encrypted.

The Business has suggested to send the credit card information in two separate emails and to split the credit card number!

  • So you are transferring the payment card information internally between the 2 offices. If this is the case, sending it out to some 3rd party online encrypted service is definitely not what you want to do. And no, splitting up the number is silly, a waste of time, and does not protect the number. – schroeder Mar 26 at 12:50
  • Can you connect systems between the 2 offices? Or is it all done by hand? – schroeder Mar 26 at 12:51
  • 1
    I know that you want an immediate solution, but your company really needs to redesign its business processes to make this more secure (and robust, and efficient, and compliant). – schroeder Mar 26 at 12:53
  • 1
    The correct thing to do here is to transfer the customer to office B in the first place as soon as you know that they're going to be responsible for the booking. If office B isn't supposed to talk to customers, then your entire process is flawed and needs to be redesinged, as @schroeder said. – Bobson Mar 26 at 13:29
  • yes i totally understand what your saying, how about something like sendinc or zix ? Wouldnt that work? I believe they are pci compliant also. – flipflophead Mar 26 at 15:09

I like the methods discussed in this article https://kirkpatrickprice.com/video/pci-requirement-4-2-never-send-unprotected-pan-end-user-technologies/.

Using end user messaging services is probably not the best way to send the PANs, but if you have to do so then establish security measures like encryption.

  • 1
    Please include the relevant parts of the link in your answer and not just the link – schroeder Mar 25 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.